CVE-2022-21718: Exposure of Resource to Wrong Sphere
(updated )
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 17.0.0-alpha.6
, 16.0.6
, 15.3.5
, 14.2.4
, and 13.6.6
allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom select-bluetooth-device
event handler. This has been patched and Electron versions 17.0.0-alpha.6
, 16.0.6
, 15.3.5
, 14.2.4
, and 13.6.6
contain the fix. Code from the GitHub Security Advisory can be added to the app to work around the issue.
References
Detect and mitigate CVE-2022-21718 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →